linux/drivers/s390/scsi
Steffen Maier 2dfa6688aa scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
Dan Carpenter kindly reported:
<quote>
The patch d27a7cb919: "zfcp: trace on request for open and close of
WKA port" from Aug 10, 2016, leads to the following static checker
warning:

	drivers/s390/scsi/zfcp_fsf.c:1615 zfcp_fsf_open_wka_port()
	warn: 'req' was already freed.

drivers/s390/scsi/zfcp_fsf.c
  1609          zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
  1610          retval = zfcp_fsf_req_send(req);
  1611          if (retval)
  1612                  zfcp_fsf_req_free(req);
                                          ^^^
Freed.

  1613  out:
  1614          spin_unlock_irq(&qdio->req_q_lock);
  1615          if (req && !IS_ERR(req))
  1616                  zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
                                                                  ^^^^^^^^^^^
Use after free.

  1617          return retval;
  1618  }

Same thing for zfcp_fsf_close_wka_port() as well.
</quote>

Rather than relying on req being NULL (or ERR_PTR) for all cases where
we don't want to trace or should not trace,
simply check retval which is unconditionally initialized with -EIO != 0
and it can only become 0 on successful retval = zfcp_fsf_req_send(req).
With that we can also remove the then again unnecessary unconditional
initialization of req which was introduced with that earlier commit.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Suggested-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: d27a7cb919 ("zfcp: trace on request for open and close of WKA port")
Cc: <stable@vger.kernel.org> #2.6.38+
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2017-02-09 19:28:19 -05:00
..
Makefile [SCSI] zfcp: remove access control tables interface 2013-05-31 16:32:38 -07:00
zfcp_aux.c s390: Remove deprecated create_singlethread_workqueue 2016-09-06 10:59:57 +02:00
zfcp_ccw.c zfcp: auto port scan resiliency 2014-11-20 09:11:30 +01:00
zfcp_dbf.c scsi: zfcp: fix rport unblock race with LUN recovery 2016-12-14 15:17:20 -05:00
zfcp_dbf.h scsi: zfcp: do not trace pure benign residual HBA responses at default level 2016-12-14 15:15:48 -05:00
zfcp_def.h zfcp: auto port scan resiliency 2014-11-20 09:11:30 +01:00
zfcp_erp.c scsi: zfcp: fix rport unblock race with LUN recovery 2016-12-14 15:17:20 -05:00
zfcp_ext.h scsi: zfcp: fix rport unblock race with LUN recovery 2016-12-14 15:17:20 -05:00
zfcp_fc.c scsi: fc: use bsg_job_done 2016-11-17 20:15:26 -05:00
zfcp_fc.h scsi: remove abuses of scsi_populate_tag 2014-11-12 11:19:41 +01:00
zfcp_fsf.c scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send 2017-02-09 19:28:19 -05:00
zfcp_fsf.h scsi: zfcp: do not trace pure benign residual HBA responses at default level 2016-12-14 15:15:48 -05:00
zfcp_qdio.c atomic: Replace atomic_{set,clear}_mask() usage 2015-07-27 14:06:24 +02:00
zfcp_qdio.h s390/comments: unify copyright messages and remove file names 2012-07-20 11:15:04 +02:00
zfcp_reqlist.h scsi: zfcp: fix use-after-"free" in FC ingress path after TMF 2016-12-14 15:14:04 -05:00
zfcp_scsi.c scsi: zfcp: fix rport unblock race with LUN recovery 2016-12-14 15:17:20 -05:00
zfcp_sysfs.c zfcp: auto port scan resiliency 2014-11-20 09:11:30 +01:00
zfcp_unit.c zfcp: Revert to original scanning behaviour 2016-04-15 16:53:12 -04:00